Overview

overview

10

Static

static

3

SaturnX_.exe

windows7-x64

10

SaturnX_.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    SaturnX_.exe

  • Size

    5.1MB

  • Sample

    240224-21p7zahb8v

  • MD5

    aef91e877861a81d25307c08539d01d3

  • SHA1

    edf78a6ed3df3374e4b34353d6cc99c6efe52dce

  • SHA256

    507440d73d9ad447ea6e576176b8b05d6f8e0e2c044a4519580a33e60dade8ba

  • SHA512

    4909486d752c340b3e998227787fc3623adcd914731712d1e18af9d0031f2b815a67086d589369ae76f4b333ddde4347d54594d8fa32ddd8bd476be78ac6491a

  • SSDEEP

    98304:GhjwP4ImCWMAWe1hynRA7NRxzChXdhb4uP5ZDETVdGx5GYZV+N13:EMu9j31wRAHGDxsxEx3ZV2t

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      SaturnX_.exe

    • Size

      5.1MB

    • MD5

      aef91e877861a81d25307c08539d01d3

    • SHA1

      edf78a6ed3df3374e4b34353d6cc99c6efe52dce

    • SHA256

      507440d73d9ad447ea6e576176b8b05d6f8e0e2c044a4519580a33e60dade8ba

    • SHA512

      4909486d752c340b3e998227787fc3623adcd914731712d1e18af9d0031f2b815a67086d589369ae76f4b333ddde4347d54594d8fa32ddd8bd476be78ac6491a

    • SSDEEP

      98304:GhjwP4ImCWMAWe1hynRA7NRxzChXdhb4uP5ZDETVdGx5GYZV+N13:EMu9j31wRAHGDxsxEx3ZV2t

    Score
    10/10
    agentteslaevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks